Privacy and Processes

Transcription

1 1 Privacy and Processes Ciarán Bryce PRIAM Saint Malo May Definition of a Process 2! A general method of doing something, involving steps or operations which are usually ordered and/or interdependent.! E.g., in manufacturing, organizations, software development, etc.! A business process is a set of linked activities that create value by transforming an input into a more valuable output. Both input and output can be artifacts and/or information and the transformation can be performed by human actors, machines, or both.

2 Why Processes are Important 3! Information system is subject to technical, organizational and legal constraints! Organizational! Applying patches and measuring effectiveness of patches,! Analyzing user behavior for application preferences and evolution of system! Ensuring people who need documents have access! Legal! Document archival for Sarbanes Oxley! Digital Restrictions Management (e.g., for software licensing)! Personal Data protection Why Processes are Important 4! Technical solutions have less and less significance! E.g., Most effective anti-virus is coherent and rigorous patching policy! Information system is an organizational bottleneck! To be agile, need to abstract IT to match roles and objectives of organization! IT Challenge is integration! Companies need architects, not programmers! Written formal description of process permits! Comparison, optimisation and analysis (e.g., for business continuity, etc.)! Foundation for execution

3 Processes versus Applications 5 Application Process Defined as Actors involved Role in organization Reliability/Availability Security Efficiency Code base Programmer, user Asset Fault Tolerance (software and hardware faults) Cryptography, access control, etc. CPU cycles, memory space, etc. Set of activities working towards precise goal Programmer, manager, operator, certifier, client, user, etc. Expresses business or organizational model Business Continuity (Bird flu, computer failure, stock market crash) Employee screening, key management, SOX compliance, etc. Man-hours, cost, sales, business intelligence. Processes in PRIAM 6! CNIL and Garante directives! Implementing them and verifying them! In functional model, the auditor is a role!! Who is permitted this role? What are associated rights? etc.! Knowledge Management is a process issue! Someone has to define ontologies - and someone has to define who that someone is! TPM management is a process issue! Roles of privacy CA need to managed: security depends on this! Software provider of functional model layer is a principal!

4 7 Example of Motivation for Process Support and challenges The EDOS Project - improving the quality of an open source distribution. Background 8! Linux is not a product. Rather, Linux is a collection of software components, individually crafted by thousands of independent hands around the world, with each component changing and evolving on its own independent Ian Murdock, timetable. creator. Linux of the is Debian not a product. projecit is a process. Ian Murdock, founder of the Debian project.! The more F/OSS users, the better!. In principle.

5 Background 9! Building a distribution involves! Producing and Collecting software! Configuring/compiling with respect to the dependencies! Quality Assurance (Testing)! Distributing to clients : boxes and download! These activities are currently tackled separately! List is not exhaustive, e.g.,! Training of developers! Scouting for clients!.! All part of the F/OSS process 10 F/OSS Environment Defects Management Production Management Version Dependency Management Community Platform Package Distribution Distribution Management Bug Test Projects Management Role ConfigurationMetric Documentation Release Tests Management Process Feedback Roles Management Application Project Activity Management Need for a transversal view of whole F/OSS process

6 F/OSS Process 11! Process! A community of actors who consume and produce resources! A multitude of activities and tools! A number of roles for activity organisation! Lack of activity coordination and performance metering leads to process inefficiency! Structured process management leads to improvement, e.g. in F/OSS,! Ontology activity that defines and binds attributes to actors and resources for more flexible lookup, e.g.,! Find package that has been tested on Mandrivalinux 10.1 with Ethernet card enabled! Find developer with experience in cryptography and Java programming! Find someone willing to act as a secondary server administrator Process Reference Model (version 1) 12! Represents the main data types used in a F/OSS process! Represents content and community in a uniform manner! Models management of any activity in the F/OSS Process! Models evolution of projects, i.e., addition and integration of new activities! The PRM provides a model of F/OSS artefacts and activities that manage these artefacts! Current format of PRM: formal model and Java API

7 PRM Model 13! The Information model binds meta-data (attributes) to artefacts! Used to lookup artefacts! E.g., find Java packages with RSA implementations! Lookup takes attribute Boolean algebra expressions! E.g., find Java cryptography packages from official mirror servers or trusted peers! Substitutability! Best match semantics in look-up! The model also defines primitives to create and lookup artifacts based on attributes! These enable F/OSS activities to be coordinated! E.g., pipeline all reported errors on package to competent developer! Lookup blocks until create of artefact with matching attributes Examples of Attributes 14 Actor Unit of Content Contact Information Knowledge Competences Interests License Version Type Target architecture Dependencies Conflicts Et cetera! Actors and content are equally important to process! Code and documentation are equally important

8 PRM Elements 15 PRM Elements Artifact Project Actor Activity Integrity Rule Right Event Process Role Task Metric Log! Core PRM Elements represent the minimal set of Artifacts for handling! Community, Projects, Resources, Responsibilities, Measurement, Etc.! Artifacts! Managed by PRM activities! Located via attributes Core PRM Activities 16 PRM Activities Artifact Artifact Management Project Project Management Actor Community Management Activity Activities Management Integrity Rule Rights Management Right Event Management Event Process Management Process Role Management Role Task Management Task Metrics Management Metric Logs Management Log Evolution? = New Activity! An activity defines a set of operations that manage artifacts and integrity rules! e.g., No version exists between old and new version for code artifacts

9 PRM Activity Interaction 17! Challenge in implementing processes is handling legacy code! Applications and Activity implementations have to communicate through the interfaces provided by the Activities Application Activity 1 Activity 2 Activity 3 PRM Model Interaction with PRM Elements Implementation 1 Implementation 2 Implementation 3 Examples of PRM Operations 18! Artifact Management! registerartifacttype(type Directory, Valuation Directory, P IR, Project):Type! newartifact(type, Value Directory, Project):! lookup(directory, Project):PArtifact! exists(artifact):boolean! substitutable(artifact, Artifact):Boolean! Activity Management! declareactivity(name, P(lambda, P IR)):Activity! associateactivity(activity, Project):void! lookup(directory):partifact! exists(activity):boolean! isassociated(activity, Project):Boolean

10 Metrics handling 19! Fundamental goal of process infrastructure is to measure and meter activities! Individual activities can have metrics (e.g., number of bug reports per package)! Or are bound to specific implementation tools! Challenge is to convert metrics to KPIs! Useful KPIs in PRIAM! Number of reported privacy violations! Relation of number of auditors to claimed violations! Relation of TPM use to reported violations! Ease of integration of functional architecture Handling metrics through the PRM 20! Creation! new Metric(description, viewpoint, metric set[], occurrence, execution)! Lookup! find(directory) -> Metric[]! Evaluation! evaluate(project, Metric) -> value! Observation! observe(project, Metric, Value) -> wait for event (metric value reached)

11 21 Current Work on the PRM Ciaran Bryce (INRIA) Olivier Abdoun (INRIA) Chrislain Razafimahefa (Shared Object) Stéphane Laurière (Mandriva) Michel Pawlak (University of Geneva) Current Work 22! Separate core process support from F/OSS support! Development of process language and (JavaCC) compiler! SOA/BPM Project! Mapping PRM to SOA infrastructure! Qualipso! Refining OSS part of PRM! Code, code, code! Aiming for release in July (Apache 2 License)

12 23 24 Architectural Overview OSS Forge TPM Identity Management PRIAM on Functional Model BP PRM Default PRM Implementation Knowledge Management Software Evolution Legacy systems (SOA, ) Apache Licence 2, except for BP parts

13 Abstract Architecture Corporate Legal 25 User and Service layer Activities Content Community Policy Kernel Layer Community Management Content Management Ontology Management Activity Management License Management Software Management Virtual Machine Native OS (e.g., Linux) Architectural Layer